--- title: "Easy Digital Downloads" description: "Easy Digital Downloads in detail: which sellers it suits, strengths, limits (3% fee, Nginx), recommended security settings and past vulnerabilities." language: "en" locale: "en-US" type: "plugin-sheet" canonical: "https://www.wp-masquerade.com/features/camouflaged-plugins/easy-digital-downloads/" published: "2026-11-05T08:00:00+00:00" modified: "2026-11-05T21:05:44+00:00" translations: en-US: "https://www.wp-masquerade.com/features/camouflaged-plugins/easy-digital-downloads/index.md" fr-FR: "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/easy-digital-downloads/index.md" es-ES: "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/easy-digital-downloads/index.md" de-DE: "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/easy-digital-downloads/index.md" it-IT: "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/easy-digital-downloads/index.md" pt-BR: "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/easy-digital-downloads/index.md" nl-NL: "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/easy-digital-downloads/index.md" --- # Easy Digital Downloads Easy Digital Downloads turns WordPress into a store for digital files, with protected download links and built-in Stripe, PayPal and Square payments. Our take to help you decide whether it fits your sales, the settings that protect files and checkout, and the vulnerabilities to know. ## The essentials - Best for selling ebooks, software or templates from WordPress, with protected download links. - Main caveat: a 3% fee on every Stripe or Square payment in the free version and with the Personal pass. - Free; Pro passes start at $199 per year for one site, adding subscriptions and abandoned cart recovery. ## What Easy Digital Downloads does on your site Easy Digital Downloads (EDD) turns WordPress into a store for digital products: ebooks, software, templates, music or photos. It adds a Downloads menu for products (multiple prices, bundles), a cart, checkout, customer accounts, discount codes, taxes, email receipts and reports. Stripe, PayPal and Square are built in, with no separate gateway plugin. After purchase, the customer gets a unique, temporary download link, valid for 24 hours by default, and you can cap the number of downloads per purchase. Files you sell live in `wp-content/uploads/edd`, a folder EDD closes to direct access with an `.htaccess` file on Apache. On Nginx that file does nothing: without the redirect rule documented by the developer, the files stay reachable by anyone who knows their URL. The model is freemium. The Lite version on wordpress.org covers straightforward selling; paid passes from the developer, Sandhills Development, add subscriptions, software licensing, content restriction or a marketplace. Without an active Extended, Professional or All Access pass, Stripe and Square payments carry a 3% per-transaction fee that goes to EDD, on top of the processor’s own fees. ![Diagram: Easy Digital Downloads works on visitors and bots, database and files, external services. Public traces: generator tag (hidden with Pro); signed HTML comments (hidden with Pro); folder name (hidden with Pro); tag IDs (hidden with Pro); generated-file folders (hidden with Pro); JavaScript variables (still visible); CSS classes (still visible).](https://www.wp-masquerade.com/media/wpm-sheets/edd/diagram-en.svg?v=8fc8e161) ## Which sellers Easy Digital Downloads is a good fit for EDD fits when you sell files or access, not boxes: - **Authors and trainers** selling ebooks, PDF guides or course material, with time-limited download links. - **Theme and plugin developers** who need license keys and automatic updates, through the Software Licensing add-on in the Professional and All Access passes. - **Template, photo and music creators** who want to keep their customers, with no platform commission. - **Content sites** adding a few paid products next to their articles. It is not the right choice for physical goods: shipping only comes with the Simple Shipping add-on in the Professional and All Access passes, while [WooCommerce](https://www.wp-masquerade.com/features/camouflaged-plugins/woocommerce/) handles stock, variations and shipping out of the box. For a membership site with levels and gated content, a dedicated plugin such as [MemberPress](https://www.wp-masquerade.com/features/camouflaged-plugins/memberpress/) is more direct. ## Easy Digital Downloads strengths and limitations ### Strengths - **Built for digital goods.** Unique expiring links, per-purchase download limits and a protected file folder are all in the free version. - **Payments built in.** Stripe, PayPal and Square connect from the settings, with cards, Apple Pay or Google Pay depending on the processor. - **Card-testing protection.** A Cloudflare Turnstile or reCAPTCHA v3 CAPTCHA can guard checkout, and switch on by itself when Stripe detects an attack. - **Your data stays with you.** Orders, customers and files stay on your site, with no listing fees or platform commission. ### Limitations - **A 3% fee below the Extended pass.** In the free version and with the Personal pass, every Stripe or Square payment carries a 3% fee on top of the processor’s fees. - **Growth features are paid.** Subscriptions, EU VAT and abandoned cart recovery need at least the Personal pass; software licensing and a marketplace need Professional. - **Files exposed on Nginx by default.** Folder protection relies on `.htaccess`: on Nginx, you have to add the rule yourself. - **Repeated serious vulnerabilities.** A privilege escalation in 2023, an SQL injection in 2024 and an administrator account takeover in 2026. ## The Easy Digital Downloads settings we recommend Paths start from the Downloads > Settings menu (version 3.7). Confirm each change with a test-mode purchase, ideally on a staging copy of the site. | Setting | Recommended value | Why | | --- | --- | --- | | **Enable Test Mode** Payments > General | Off in production | In test mode, no live transactions are processed. | | **Enforce SSL on Checkout** Payments > Checkout | On | Sends every customer to the HTTPS checkout page. The setting stays grayed out until the site has a certificate. | | **Customer Registration** Payments > Checkout | “Allow customers to place orders without an account” (default) | Fewer customer accounts means fewer credentials to protect. | | **CAPTCHA Provider** Misc > Spam Protection | Cloudflare Turnstile or reCAPTCHA v3 | None by default. Needs keys from the chosen service; the next two settings depend on it. | | **CAPTCHA on Checkout** Misc > Spam Protection | “Only for guests” or “Always” | Slows down bots testing stolen cards. Requires the checkout block, not the shortcode. | | **CAPTCHA on Demand** Misc > Spam Protection | On | Shows the CAPTCHA when Stripe detects card testing on your site. Only offered when Stripe is active and checkout uses the block. | | **Download Method** Misc > File Downloads | Forced (default) | The real file URL stays hidden and the folder is closed on Apache. “Redirect” only blocks directory listing. | | **Download Link Expiration** Misc > File Downloads | 24 hours (default) or less | A forwarded or posted link soon stops working; a new receipt generates a valid one. | | **File Download Limit** Misc > File Downloads | A sensible number, for example 5 | Unlimited by default (0). A limit curbs link sharing, and it can be reset per purchase. | - On Nginx, add the redirect rule documented by EDD, then check that a direct URL to a file in `uploads/edd` returns an error. - Leave “Remove Data on Uninstall” unchecked in Misc > General: when checked, deleting the plugin wipes orders and customers. - In Payments > General, keep only the payment methods you actually use under “Active Gateways”. - In Users, give the Shop Manager role only to people you trust, and turn on automatic updates for EDD under Plugins. ## Easy Digital Downloads security: guest checkout and payments Checkout and payment gateway callbacks answer anonymous visitors, which explains several serious flaws that need no account: - **May 2023, CVE-2023-30869**: an unauthenticated [privilege escalation](https://www.wp-masquerade.com/glossary/privilege-escalation/) affected versions 3.1 to 3.1.1.4.1 (CVSS 9.8). Fixed in 3.1.1.4.2. - **August 2024, CVE-2024-5057**: an [SQL injection](https://www.wp-masquerade.com/glossary/sql-injection/) in versions up to 3.2.12 (CVSS 9.3). Fixed in 3.3.1. - **November 2026, CVE-2026-120538**: during a guest checkout paid with PayPal, the email address entered was enough to attach the order to an existing account and then log in as that user, including an administrator with no EDD customer record. Versions up to 3.7.2 (CVSS 8.1), fixed in 3.7.3. The useful step: stay on the latest version, 3.7.3 at minimum as of today, with automatic updates. Card testing is covered in our online store security guide. Hiding EDD fixes no vulnerability, but WP Masquerade Pro removes its generator tag, its signed comments and its folder name from file URLs, clues bots use to pick their targets. ## Easy Digital Downloads FAQ **Is Easy Digital Downloads really free?** The Lite version is free with no limit on products or sales, but Stripe and Square payments carry a 3% fee until you have at least the Extended pass ($399 per year for one site). Pro passes run from $199 per year for one site (Personal) to $999 per year for three sites (All Access), at the full price that applies to renewals. **Do my customers have to create an account to buy?** No, not by default. The Customer Registration setting also lets you require an account or create one automatically at purchase. **Are my files protected on an Nginx server?** Not without action: Nginx ignores the `.htaccess` file in the `uploads/edd` folder. Add the Nginx rule from the EDD documentation; on that server, the Site Health screen shows “Your download files may not be protected” as a reminder. **Easy Digital Downloads or WooCommerce for selling files?** For a digital-only store, EDD gets to the point faster. If you also sell physical products, WooCommerce saves you from stacking add-ons. ## Key facts - Category: E-commerce - Vendor: Sandhills Development - Price: Free (Lite); Pro passes from $199 per year for one site (Personal), the full price that applies to renewals - Active installations (wordpress.org): 40 000+ - Version: 3.7.3 - Official page: https://wordpress.org/plugins/easy-digital-downloads/ ## What WP Masquerade hides - Handled by WP Masquerade Pro only - With Pro: generator tag, signed HTML comments, folder name, tag IDs, generated-file folders - Still visible: JavaScript variables, CSS classes